Australians facing spike in data breaches after 'critical' flaw uncovered

Australians should expect an increase in future data breaches as a result of critical software flaws that have forced major government websites, education platforms and web hosts to go offline.

The AI-assisted discovery of a vulnerability in a crucial piece of web architecture used by most websites, known as PHP, has set off a global scramble to patch millions of devices as major tech companies warn that bad actors have begun seizing on it.

The flaws, dubbed "PHP2shell", have been present for more than a decade, but are so serious that cybersecurity experts have urged widespread action to avoid major breaches.

"You have to patch it very, very quickly, or the suggestion is to take it offline," Australian web security expert Troy Hunt told ABC News Breakfast.

What happened?

Yesterday, the organisation behind PHP issued a security alert about the discovery of two "critical" vulnerabilities.

PHP is used in the back end of an estimated seven in 10 websites and applications, including Wordpress and Wikipedia.

These vulnerabilities would allow attackers to run their own code on affected servers without logging in, a major cybersecurity flaw that would allow unauthorised control to do anything from extracting user data to implanting other malware.

PHP works on the server behind a website, producing content for a visitor's browser. The flaws can let attackers run their own code on affected servers without logging in, according to PHP's security advisory.

The risk varies with the way a server is set up, but PHP's developers urged all users serving web pages to update immediately.

The PHP Foundation, a non-profit organisation maintaining and developing the PHP ecosystem, released a fix early this morning and urged all operators to update immediately.

Amazon Web Services, a subsidiary of the US tech giant offering cloud computing platforms, said it had already seen evidence of attempts to exploit the vulnerability as early as October 17.

"The targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure," it said in a blog post.

Major organisations go dark

Australia's own cybersecurity agency, the Australian Signals Directorate, put out a rare critical alert about the flaw directed at everyone from government and critical infrastructure to individuals and families.

Major Australian organisations took drastic steps to avoid falling victim until they were able to ensure that they had patched their own devices.

GovCMS, which hosts many major Australian government websites, blocked direct access to its servers while keeping cached copies of public pages available.

Moodle, an Australian education technology company whose software powers hundreds of thousands of university and schools' online learning platforms, also took its website offline as a precaution, before beginning to restore them after applying security fixes.

Australian hosting provider VentraIP restricted some of its file uploads on customer hosting, warning that forms accepting attachments could fail.

Even smaller website operators such as those running Australian forum for customising computer hardware went down as a precaution.

Mr Hunt said there was little Australians needed to do, but the worst-case scenario was a breach of websites holding their personal information.

"We just need to expect that we may have some elevated instances of the data breaches that we're already seeing every day," he said.

AI helped discover 'critical' flaw

US-based security firm Calif said it had identified a critical flaw using OpenAI's AI models as part of a cybersecurity program it was running.

While the bug appears to have been present in versions of PHP released as far back as 2012, Calif said it took existing research that theorised about a possible attack vector and used AI to confirm the existence of a legitimate vulnerability.

The PHP Foundation said a developer had found the first signs of the underlying problem behind one of the flaws in 2024, but its work repeatedly stalled amid difficult technical choices and limited resources.

AI helped assess reports, the foundation said, while humans remained responsible for decisions and fixes.

"A person makes every call and works on every patch," it said.

OpenAI warned that the same capabilities helping defenders find vulnerabilities could help attackers rapidly develop tools to exploit them.

Additional reporting by national technology reporter Ange Lavoipierre